19 ms·

Top EU court overturns US data transfer agreement in Facebook case

354 points by tpush 6y ago

hugoroy 6y ago
The judgment is here: https://noyb.eu/files/CJEU/judgment.pdf https://noyb.eu/files/CJEU/judgment.pdf Start at page 28 if you want to skip the recap of EU law, or start at page 35 if you want to skip the details of US law and surveillance programs as recap by the Irish court who referred the ruling.
- amelius 6y ago
  > MrSchrems, an Austrian national residing in Austria, ... It's a bit sad that people have to fight this war on personal title.
  - the_duke 6y ago
    Schrems has a history of doing this. [1] It's mainly odd to me that there aren't more privacy / consumer protection groups doing the same things he does. [1] https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
    - corty 6y ago
      European privacy and consumer support groups are mainly after lawyers' fees. They mostly make money by notifying misbehaving companies of their misbehaviour, collecting fees for the (usually unwanted, but enforcedly payable) notification ("Abmahnung" in German). Dieselgate was started by such a group. The system is not all bad, but incentives are against stuff like this being litigated by the usual privacy or consumer support groups, because you just can't collect fees from the legislative branch...
      - esperent 6y ago
        Which groups are you talking about?
    - moksly 6y ago
      I think there is a multitude of reasons, most consumer protection NGOs aren’t very tech savvy and it’s hard to raise funding for privacy because the general population doesn’t care enough to donate money to it. It’s also a rather hard battle to enter because EU law is so ridiculous complex, and most privacy advocates aren’t very law savvy. There are a lot of smaller groups fighting, but it takes years and years to see results. Hopefully the EU itself will get more into it now that our relationship with the US is deteriorating and China is getting more and more aggressive. Not that it’ll matter too much with Microsoft being the only real option in non-tech enterprise.
  - Proven 6y ago
    It's outrageous that one person can indirectly force millions to buy more expensive services. Anyone who cared and had the extra money could have always kept their data in the EU. Or not pay for any service that doesn't.
  - icebraining 6y ago
    He created an NGO for this purpose, after having successfully sued Facebook: https://noyb.eu/en https://noyb.eu/en But the national data protection commissions of each country also do plenty of work. I think they're still swamped, though.
    - smartbit 6y ago
      nyob is in need of financial support https://noyb.eu/en/support-us https://noyb.eu/en/support-us. No need to leave you address unless you want to receive the goodies. No Credit Card required either, an EU bank account for SEPA transfers is sufficient. If you donate EUR 100, you get Consultation on private data protection cases (2h/year)
    - tgsovlerkhgsel 6y ago
      The Irish DPA seems to focus on not doing their work, and actively fighting back against having to do their work. The German DPAs love going after random individual cases they find, often in ways incompatible with reality (e.g. a small company not using GPG when e-mailing employees about HR issues), while ignoring major abuses that happen at scale. The biggest fine they issued was to a real estate management company for not deleting old documents (e.g. proof of income) that tenants had provided. Not a single fine against adtech companies.
- lis 6y ago
  In addition there is a short PR statement available for media use: https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202...
  - hugoroy 6y ago
    This is the press release, edited by the services of the court - this is not written by the judges.
    - lis 6y ago
      Yes, thanks, I've clarified this.
- pwdisswordfish2 6y ago
  Start at page 61 if you just want the ruling. Perhaps this Wikipedia page will be updated soon: https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield
Krasnol 6y ago
This was long overdue. Let's hope they won't come up with a new name just as they did last time when Safe Harbour was abolished. This thing was an insult to EU privacy laws.
- killerpopiller 6y ago
  after "Safe-Harbor"and it's successor "EU-US Privacy-Shield" I suggest.. the "Trust-PACT" P - privacy A - acknowledged C - confidentiality T - treaty It's not only an insult of EU data protection laws and the EU basic rights charta. Not only are the big US cloud providers evading taxes and stiffling competition in the EU, they are also instrumental to US hegemonial ambitions. All your data (and taxes) belongs to us. That's whats going on. I wonder how long the standard contractual clauses will hold, I don't see how they are doing better.
  - di4na 6y ago
    This judgement also validated SCC. Basically they are ok because they are underpinned by "the receiver country need to have proper privacy protections". So the SCC is legit. You just can't use it with the US.
geewee 6y ago
This is bad news for everyone in the EU who has data in the US and uses the Privacy Shield act as the protection guarantee. We do that currently for some data processors, and I'm a little intrigued about what we'll do with all of our US-based data now.
- arpinum 6y ago
  The ruling notes that standard contractual clauses are still available. Most providers offer a Data Processing Agreement that can be signed and amended to the standard contract for businesses in the EU. It then gets muddy though as a DPA needs to be considered against possible legal demands of the US Gov and whether the processor will be forced to comply, assuming the data is stored unencrypted and it is possible to comply.
  - geewee 6y ago
    Yes hopefully it'll just be some extra paperwork.
  - ThePhysicist 6y ago
    You cannot rely on these clauses if they can't be effectively enforced, so I'm doubtful whether they will allow you transferring personal data to the US.
  - terom 6y ago
    Quoting from the press release, the data exporter must take into account both the contractual clauses AND the surveillance laws of the target country. It is not sufficient to rely on a contract with a US data processor where the US surveillance laws do not make it possible for the recipient to comply with that contract. > In those circumstances, the Court specifies that the assessment of that level of protection must take into consideration both the contractual clauses agreed between the data exporter established in the EU and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the data transferred, the relevant aspects of the legal system of that third country. > [...] that decision imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected in the third country concerned and that the decision requires the recipient to inform the data exporter of any inability to comply with the standard data protection clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former.
mlang23 6y ago
Finally! There is hope for EU, they apparently found some of their balls. Hope they keep 'em.
adamcharnock 6y ago
Hum. I’m in the process of starting up a Wireless ISP in Europe. I was looking at using a large piece of management software provided by a Canadian company, hosted in the US. This is starting to feel like a bit of a bad idea. I was already unimpressed with their “no one has ever asked us about GDPR” response. I can totally see an ISP getting heavier regulation in this regard too, given it is providing infrastructure. Maybe I’ll code it all up myself while I wait for the dedicated fibre to come through.
- dx034 6y ago
  Any reason why it has to be hosted in the US? Hosting is so standardized, it's hard to argue why it can't be moved to the EU.
  - adamcharnock 6y ago
    It is a SaaS product and I guess that was just what made sense to them at the time. They say they have a lot of EU customers, but something doesn't add up. Either they don't have a lot of EU customers, or their EU customers are ignoring GDPR, hosting locations, and (in my case) regulations on invoicing software. Maybe those customers are just saying, "ah, it'll be fine, let's not worry about it." Which probably isn't a bad approach for small companies. I suppose my choice comes down to: Do I want something off the shelf, slick, a bit expensive, and may or may not screw me in known ways. Or do I want something custom, slow to build, a bit clunkly, can adapt to my needs at the cost of my time, and won't screw me in known ways. Of course, both may screw me in unknown ways :-) Anyway, thanks for listening. This is mostly me just thinking this though.
    - m4rtink 6y ago
      SaaS management system for WISP seems weird to me. From what I know from the local WISPs their internal systems need to be very robust and independent from internet connectivity, so when the network or Internet connectivity goes down, they are still available to quickly resolve the issue.
arpinum 6y ago
I work in a sector with a requirement to keep data out of the US. It is VERY hard to find providers who can promise not to do this. Even when servers exist in the EU, many provider's contracts have clauses that allow transfer to the US, as they have staff there who may access the data. I can see company legal departments taking this ruling to prohibit transfers, even with a DPA in place, and causing havoc around the EU.
- mytailorisrich 6y ago
  The EU depends too much on the US in this area. Hopefully this will force more independence and provide a boost to the European providers.
  - sam_lowry_ 6y ago
    Which area? Hetzner, Leaseweb, OVH and dozens of smaller hosting providers can fill the needs. The only thing US hosting providers have is marketing and easy money.
    - corty 6y ago
      Hosted Microsoft products mostly, which is what tons of smaller companies want from "the cloud". And some AWS workalike, which usually means AWS, because the stackoverflow answer they found doesn't tell them about the rest.
      - nix23 6y ago
        Haha you are so right!! That i think is the biggest problem with Europe, Microsoft an Apple is just everywhere...probably even more Windows installations on servers than the US.
    - arpinum 6y ago
      Managed service offerings are the main difficulty. Bare servers aren't a problem.
- 6y ago
mtgx 6y ago
WSJ: Surprise ruling is a victory for privacy activists This wasn't a surprise at all. It was very predictable from the beginning for one simple reason: the US doesn't have strong privacy laws and the US government's surveillance apparatus doesn't account for whatever privacy laws exist either. All the gag orders (up to half of all total order requests according to Microsoft 2 years ago), all the tapping of internet cables and "partnerships" with the carriers, all the "fusion centers" with all agencies getting people's data, and so on. Oh, and best of all, the Privacy Shield said that it was up to the US DOJ to ensure US companies followed EU law. What a joke. The EU Charter of Fundamental rights prohibits data from being stored in countries that don't provide equivalent privacy protections as in the EU. If you follow this logic, it's obvious Privacy Shield was bound to fail. An article from 2018: https://www.hrw.org/news/2017/07/26/us-surveillance-makes-privacy-shield-invalid https://www.hrw.org/news/2017/07/26/us-surveillance-makes-pr...
tdrp 6y ago
Is there some kind of "we are in the EU and understand our data will be stored in the US and can be surveilled" consent box? What about platforms that connect people from all over the world? Yeah you can store EU users' data on an EU server but what if a US user checks out a EU user's profile. Or are we supposed to completely disconnect each continent?
- Dobbs 6y ago
  You work to the most restrictive set of rules. EU users data is stored in places that comply with the rules in question, that could be the US, if the US complies with EU rules. If US user wants to interact with EU content, then they need to comply with relevant EU rules. They might not have to give the same level of enthusiastic consent, but the data of their interaction should still stored in EU compliant manner.
  - adventured 6y ago
    That's not quite correct. It depends entirely on what jurisdiction/s you fall under, where you do business. If you're a US entity you can freely store EU data on US servers entirely without EU permission or consent, and do anything with it that you want to (within US law), so long as you don't operate within the EU. For exactly the same reason that you can safely ignore GDPR if you don't operate in the EU. If I build a service that runs its servers only in the US, in nearly all cases I don't need to concern myself with EU laws. I'll be operating by US laws. I can allow EU users to sign up and use my service and store their data in the US. There's nothing the EU can do about that. The EU will have to enable a draconian Chinese firewall to stop this. They have no power or influence to dictate to the world such rules, so the only thing they can potentially do is put their own people in a safety box and lock them off from the rest of the world.
    - HatchedLake721 6y ago
      This is wrong? It doesn't matter where your servers are, if you offer a service to people in the EU and you store their personal data, you need to safeguard that data and comply with GDPR. It's a law, so it can be enforced through mutual international treaties. However, common sense prevails in the EU and especially with GDPR, so no one will go after you because you use Google Analytics and didn't give an option to opt-out. But if you start collecting personal addresses, emails and phones disguised as a charity doubling their contributions and then sell that information to callcenters abroad for tax scams and upload it to 4chan, then yes, EU's reach will be tested. https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/
secfirstmd 6y ago
Worth also remembering that at the moment the UK is still negotiating with the EU and hasn't got a data protection adequacy agreement in place. At the same time it is domestically pushing for increased surveillance laws and powers for GCHQ etc. That issue in many ways is going to be just, if not more, tricky.
_the_inflator 6y ago
At the political level this is going to fuel the conflict between USA and EU. Gas pipeline, data privacy - times have changed forever it seems between USA and EU.
- bad_user 6y ago
  I don't see a conflict. European countries have had consumer protection laws that are different from those in the US and US companies have had to comply. This situation is no different. The EU wants privacy & security guarantees that US companies can't deliver and special deals with the US government can't really fix that. But I'm sure US companies will adapt eventually. And this goes in both directions of course. For example European banks have to be really careful in dealing with US citizens due to laws like FATCA.
  - allendoerfer 6y ago
    > For example European banks have to be really careful in dealing with US citizens due to laws like FATCA. Their fix is of course to require you to check the "I am not a US citizen" box.
    - the_svd_doctor 6y ago
      I don’t know if that’s sarcastic, but banks are scared to hell to deal with US citizens. They won’t ask you to fill the other box, they just won’t deal with you.
      - sebazzz 6y ago
        It is not sarcastic - my bank (ING) has these in the forms, for instance when getting started with their stock buying program.
        lokedhs 6y ago
        Many banks will not allow US citizens to open accounts for that reason. If they have any US account holders, they will have to report to their tax authority.
vicmiclovich 6y ago
What if the US reciprocates? EU companies doing the same - keeping US data in the US.
jeroenhd 6y ago
Privacy Shield is dead, long live privacy shield. I wonder how many attempts it will take for this deal to be considered legal before the US actually has to do something to hold up their end of the deal. The US government would scream in rage if Germany would ever demand the ability to order Microsoft or Google to hand over information about US citizens in complete secret, yet the EU wil gladly take the word of the US government that it won't happen. The EU also has plenty of incentive to encourage keeping data within the boundaries of its member states. Making it difficult to use American tech giants as a lazy quick fix for data storage instead of looking at local alternatives only helps limit the amount of money taken from the European economy. With the scandals and state of the current US government I find it hard to believe the EU will be able to draft a new agreement like this with the US without compromising on the rights of their citizens.
- KingOfCoders 6y ago
  The US never will.
- Dobbs 6y ago
  > Privacy Shield is dead, long live privacy shield. Apologies for being pedantic, but "The king is dead, long live the king" is referring to two distinct uses of the word king. It is equivalent of "The old monarch is dead, long live the new monarch". So for this to work in your case it would need to be: "Privacy Shield is dead, long live new-replacement-law" But without a replacement law, the phrase just doesn't work.
  - ceejayoz 6y ago
    That's probably why the first Privacy Shield was capitalized, but the second was not.
  - jeroenhd 6y ago
    My point was that there will probably soon be a new, similarly lacking Privacy Shield with a similarly silly name (Secure Data Exchange Act? Privacy Protection Plus? Data Protector Agreement?). We don't know the name of the new law yet, but Privacy Shield was quickly implemented because the agreement before it was deemed insufficient, and the same will likely happen again.
fmajid 6y ago
I don’t know why the article claims the decision was “surprising”. I work for a US company that is subject to GDPR and we’ve been expecting this for over 2 years, the only unknown was when the ruling would happen, not if.
the_duke 6y ago
Already on the front page, with more comments: https://news.ycombinator.com/item?id=23856988 https://news.ycombinator.com/item?id=23856988 Both submissions are very shallow articles though.
idkwhoiam 6y ago
Imagine every country comes up with a similar law restricting personal data transfers. This will render Internet useless.
- danarmak 6y ago
  An Internet with no personal data is a far cry from useless.
  - perpetualpatzer 6y ago
    But surely, you'd concede it's far less useful. No international email, social media. No access to foreign websites: IP addresses are personal data [0]. Possibly, service delivery is feasible if you set up a warehouse in both locations to freight forward, but any vendor without the means to operate in each country. While I expect my EU pals will say "but of course we will never apply the law that way," if this was the intent of the legislation, the legislation looks an awful lot like a nationalist tariff. [0]https://www.alstonprivacy.com/ecj-declares-ip-addresses-personal-data/?cn-reloaded=1 https://www.alstonprivacy.com/ecj-declares-ip-addresses-pers...
    - danarmak 6y ago
      > No access to foreign websites: IP addresses are personal data The OP talks about not storing personal data, which would mean e.g. not keeping logs of client IP addresses; that does not forbid the Internet. I agree that a law that literally says or is interpreted to say that my IP address must not cross international borders, forbids the international Internet. But there is no such law. It's possible to put together an argument to interpret laws in an undesirable or unexpected way. That's what lawyers are for. We have to have some measure of confidence in court rulings, that's part of the system, law interpretation is always being challenged. > No international email, social media. To the best of my understanding, the GDPR allows people to opt-in to send personal data. If I send an email to someone in the US, I deliberately share e.g. my name with them; that's legal. If I send an email to someone in Europe, and my and their email providers are companies operating in Europe, they should not transmit or store the email through US servers. That's not impossible. At least that's my understanding. The problem with social networks is legitimate, and a real problem, but it's vastly smaller than "the Internet".
Barrin92 6y ago
As a EU citizen I'm glad about the decision, I don't have any confidence any more that data stored in the US is secure and that the US can be depended upon. Also important to point out how much of this goes back to Max Schrems activism over the years and noyb (https://noyb.eu/en https://noyb.eu/en). This is a huge win achieved with relatively few resources. Staying engaged is worth it.
- Frost1x 6y ago
  As a US citizen, I'm personally glad to see other nations push back against data privacy exploitation by US businesses on the general public. It's evident our own (US) government will do very little to curb those business's overreach. I hope to see more disincentives put forth against these practices in markets our businesses haven't completely supplanted government oversight. Hopefully, that will result in shifts of practices in the US markets as well, though it's certainly not guaranteed.
  - nojvek 6y ago
    China is looked down for its draconian surveillance. However US is just another side of the same coin. Our big Tech FAANG loves gobbling up everything they can get their hands upon in the name of training AIs that shove more personalized creepy ads.
    - jjcon 6y ago
      > China is looked down for its draconian surveillance. However US is just another side of the same coin. This is not the case - almost all major countries have surveillance agencies. It’s not the fact that China has surveilance that is looked down upon, it’s the lack of checks and balances. Most democratic countries have surveillance to ensure national security interests and they have strict checks and balances to minimize abuse and ensure that intel is used only for national security reasons. China’s surveillance has no such checks and balances and does little to prevent abuse and that is worth criticizing. Perhaps this may change someday but the current party does not seem to be heading in that direction.
- 6y ago
eitland 6y ago
Hmmmmm. If Apple can get away with providing a less secure version for China they could probably get away with creating a more secure version for Europe..?
poorman 6y ago
They are really making it impossible to start a small SaaS product. People already don’t want to pay $4/mo. for even some of the most popular SaaS products. I’m afraid all this is going to do is cause these small SaaS businesses to run twice as much infrastructure, and then transfer the costs onto the consumers by substantially increasing their prices.
- FranzFerdiNaN 6y ago
  Yes, privacy has a cost.
- Cthulhu_ 6y ago
  As it should be; I want to pay with money, not my data. And I want my spending to stay in my local economy, not to the bottomless pit that is the US.
- Sebb767 6y ago
  We're happily running a small SaaS with 4 servers using a small provider near Frankfurt for less than 50 Euro/Month. In fact, this provider is massively cheaper than AWS for bare metal and we had no service problems so far. It's maybe not five nines, but the limit is really not the service provider ATM.
jurschreuder 6y ago
I'm missing the point of why the USA would not just stop this weird spying on everybody. From China I'd expect nothing more but the USA? They're supposed to be a decent country. Then we would not need all these super unpractical counter measures.
- Cthulhu_ 6y ago
  > They're supposed to be a decent country. But they are not; they're dropping fast on the world scheme when it comes to human rights and common decency. In many ways it's as bad as China is when it comes to that. It's interesting that they managed to keep the ICE concentration camps out of the media. Will the >100K of covid-19 related deaths (that have been officially reported) someday be considered genocide / eugenics?
  - e773yeydyyd 6y ago
    This is certainly a romantic take on the matter but for once the liberal arts students are actually ahead of the curve since for many of them this reading is a part of their standard curriculum (followed by an exercise where some defend the practice and some condemn it): https://www.wsj.com/articles/SB95326824311657269 https://www.wsj.com/articles/SB95326824311657269
    - kergonath 6y ago
      Spying is fair game. So is using obvious spying as a PR or political weapon. Dragnet surveillance is something else, though.
- veeti 6y ago
  Did people already forget all about the 2013 leaks? Do you actually think that the EU is not complicit in the same surveillance practiced by the US? > For example, Der Spiegel revealed how the German Foreign Intelligence Service transfers "massive amounts of intercepted data to the NSA", while Swedish Television revealed the National Defence Radio Establishment (FRA) provided the NSA with data from its cable collection, under a secret treaty signed in 1954 for bilateral cooperation on surveillance... How is my data any more secure on a German server than an American server? Some asshole is snooping on it anyway, and the NSA gets access by extension.
34679 6y ago
Nobody in the US government is going to scream in rage over the violation of your privacy. The last person who came close is hiding in Russia.
- deleted 6y ago
  [deleted]
- StavrosK 6y ago
  > Nobody in the US government is going to scream in rage over the violation of your privacy. by the US government. Plenty of people are screaming in rage about China, for example.
  - simion314 6y ago
    That is not even close related with privacy or human rights and more about geo-politics.
    - tobessebot 6y ago
      US-EU data agreements are also about geopolitics.
      - simion314 6y ago
        Maybe, but there was some agreement and one party is not respecting it, so let's say is not nice not to respect your contracts. Star Trek fans are probably reminded by this rule of acquisitions; "A contract is a contract is a contract… but only between Ferengi."
        normalnorm 6y ago
        The EU is not some weird hive-mind, it has separation of powers just like the US. It is the European Court of Justice's job to overturn executive decisions that trample on the constitutional rights of its citizens, same as the Supreme Court in the US.
terom 6y ago
The idea would be to align the commercial interests of US cloud service providers with the privacy interests of EU customers. From the EU citizens perspective, the ideal outcome would be for US cloud service providers to pressure US authorities to limit their surveillance of EU citizens and provide some kind of privacy guarantees. Here's to wishful thinking...
- DaiPlusPlus 6y ago
  Google, of all companies, was a major supporter of California's CCPA (Cali's GDPR-like legislation) last year. Cynically I suppose it was to ensure they'd at least have a say in what the CCPA covered... and to hurt their rivals (Facebook, etc).
  - TomMarius 6y ago
    GDPR was supported by the biggest EU corporations as well - not much could help them more :-)
    - dijit 6y ago
      The idea the GDPR as a regulation helps established companies 'who can afford a gdpr team' more than joe the shoemaker is a weird meme.. GDPR hurts large companies that abuse data; the actual legislature is one of the most proportional regulations I've ever seen. You have the right to store peoples personal data if it's used and not processed for non-implied purposes (IE; generating profiles of people after sale) and not sold to another company. So when someone throws up a big "GDPR NOTICE" and you have to press the big "i agree" button, it behooves to read it; because that's often not required for the service, it's what's required for the company to sell on your data. Joe the Shoemaker can take your email address or phone number and call you, he's not going to have a hard time under GDPR. If you're abusing data, you're going to have a hard time- and that's good.
      - TomMarius 6y ago
        Most companies don't (and never did nor are or were in position to) abuse data, but all companies now must adhere to GDPR. ;-) The world really isn't either Facebook or Joe the Shoemaker. There's a lot in between.
KingOfCoders 6y ago
This means noone in the EU can sell on Amazon or eBay. Noone can use services like WebFlow and other hosting solutions. We'll see what future court decisions say about AWS hosted inside the EU.
- KingOfCoders 6y ago
  Everyone who sells on Amazon and eBay has a data protection policy which mentions Privacy Shield to legally work with Amazon. The court says only DPAs work where you make sure that the other party protects data on a GDPR level, which Amazon doesn't do and can't do.
KingOfCoders 6y ago
Noone in the EU now can sell on Amazon or eBay.
rydre 6y ago
Good job Euros! Now you need to level up tech sector, get rid of the shackles of Google, Apple, Facebook. Your startups deserve better then the current, anti competitive and worse environment! Your companies could do much better, now is the time and make it happen.
- leadingthenet 6y ago
  It’s never going to happen. We’re a completely decadent society, and we’re essentially out of the IT race at this point.
  - zurfer 6y ago
    Well it's not even the right point to discuss. A lot of great software is developed in Europe (not necessarily by companies with European headquarters). But why should software companies be tied to a specific region. Great software can come from the US, Australia, Asia, Europe, ... Because in the end it comes from people and the entrance barrier gets lower and lower. What you point to is probably more a question of finance and ownership.
  - pjc50 6y ago
    People keep saying this while ignoring the local huge boring IT companies and local subsidiaries of US IT companies. Does it really matter where the nameplate that indicates where the HQ is? Or does it matter where the profits are taken for tax purposes (Apple appears to be an Irish company, by that measure)? Or where the CEO and board members are domiciled? Where the actual staff sit when they work?
    - d1zzy 6y ago
      So what you're saying is, that as long as there are other places in the world, outside of Europe, that still have a regulatory/financial/mentality/etc framework where new large software corporations can appear and flourish (and then open offices in Europe), then it's all good for Europe. If so, doesn't that seem a bit hypocritical? To have tighter privacy regulations locally but then be happy to accept business/jobs from companies that exist _because_ of no such regulations in other places (or at the time they were established)?
lukejduncan 6y ago
Dumb question: can someone explain to me the implications on startups and side projects? Does data mean, any data? If I’m reading that correctly it’s illegal to allow EU users to use any website with a DB that isn’t hosted in the EU. That can’t be correct, can it?
- x0x0 6y ago
  EU residents enjoy a right to data protection. US residents do not. EU allows export of their residents' personal data to the US under different sets of rules or methods, one of which is (was?) Privacy Shield. Another is Contractual Clauses. The crucial fact for Privacy Shield is it was supposed to provide "equivalent" protections (ie protection for EU data hosted in the US equivalent to that data being entirely in the EU). It did not. My take is that Privacy Shield was a sop to the fact that the US never had anything like equivalent privacy laws, but we are (were?) too big a trading partner to apply the law to. This realpolitik appears now to be in question. So yes, one of the ways to legally allow a US-based company to process EU resident data has now been removed.
- M2Ys4U 6y ago
  It's personal data. Which is defined in the GDPR as: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
  - lukejduncan 6y ago
    I’m sure the true answer is ambiguous, but “personal data” by that definition seems to imply almost any form of account creation. For sure, that seems to imply you can’t use email addresses as identifiers. Maybe it implies that so long as the data isn’t de facto joinable with side data (phone numbers, email addresses) it may be ok.
- IAmEveryone 6y ago
jjcon 6y ago
> to adequately protect Europeans' data from US surveillance and security laws and was therefore invalid Certainly this is more about protection from corporations with the added benefit of preserving what’s left of tech in the EU. Considering the US and most major EU countries share intelligence information with each other and all have surveillance programs I don’t know that it would be very effective at doing that no matter where the data is.
brownbat 6y ago
Will this have implications for Chinese and Russian services as well? Will the EU go fully local?
- M2Ys4U 6y ago
  Not really, because the European Commission has not issued an adequacy decision in relation to China and Russia as far as I'm aware. Russia is an interesting case, though. They are bound by the European Convention on Human Rights (although enforcement is... let's say tricky), and they are also signatories to Convention 108 (the Council of Europe "Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data") and they have signed (but not ratified) the protocol to update the convention (223, combined known as Convention 108+). This - in theory - puts them at an advantage over countries like the US which lack any real privacy legislation. However 1) Theory and practice aren't the same; and 2) I think it would be an impossibly hard sell for the Commission to issue an adequacy decision for Russia purely for political reasons, let alone practical ones.
  - brownbat 6y ago
    Oh interesting: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte... So Russia/China are already in the "further safeguards needed" camp, along with... almost all of the world? I studied a bit of EU law in law school, but haven't kept up as much as I should. This is a helpful start to dig back in, thanks!
boshomi 6y ago
Max Schrems[1]: “The Court clarified for a second time now that there is a clash between EU privacy law and US surveillance law. As the EU will not change its fundamental rights to please the NSA, the only way to overcome this clash is for the US to introduce solid privacy rights for all people – including foreigners. Surveillance reform thereby becomes crucial for the business interests of Silicon Valley." "This judgment is not the cause of a limit to data transfers, but the consequence of US surveillance laws. You can’t blame the Court for saying the unavoidable - when shit hits the fan, you can’t blame the fan." [1] https://noyb.eu/en/cjeu https://noyb.eu/en/cjeu
Aachen 6y ago
This has been going back and forth for a long time now. Perhaps I'm being naive, but given light delay, companies already host data about and data accessed by citizens from <insert continent> on said continent, so why don't companies just store EU data in the EU and be done with it? Wouldn't that solve the whole issue, years in court, ambiguous rules, companies/agencies that require local storage, etc.?
plandis 6y ago
This just seems protectionist to me. I imagine anything the US is doing is being done by spy/sigint agencies within the EU

354 points by tpush 6y ago

The judgment is here: https://noyb.eu/files/CJEU/judgment.pdf https://noyb.eu/files/CJEU/judgment.pdf Start at page 28 if you want to skip the recap of EU law, or start at page 35 if you want to skip the details of US law and surveillance programs as recap by the Irish court who referred the ruling.

amelius 6y ago
> MrSchrems, an Austrian national residing in Austria, ... It's a bit sad that people have to fight this war on personal title.
- the_duke 6y ago
  Schrems has a history of doing this. [1] It's mainly odd to me that there aren't more privacy / consumer protection groups doing the same things he does. [1] https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
  - corty 6y ago
    European privacy and consumer support groups are mainly after lawyers' fees. They mostly make money by notifying misbehaving companies of their misbehaviour, collecting fees for the (usually unwanted, but enforcedly payable) notification ("Abmahnung" in German). Dieselgate was started by such a group. The system is not all bad, but incentives are against stuff like this being litigated by the usual privacy or consumer support groups, because you just can't collect fees from the legislative branch...
    - esperent 6y ago
      Which groups are you talking about?
  - moksly 6y ago
    I think there is a multitude of reasons, most consumer protection NGOs aren’t very tech savvy and it’s hard to raise funding for privacy because the general population doesn’t care enough to donate money to it. It’s also a rather hard battle to enter because EU law is so ridiculous complex, and most privacy advocates aren’t very law savvy. There are a lot of smaller groups fighting, but it takes years and years to see results. Hopefully the EU itself will get more into it now that our relationship with the US is deteriorating and China is getting more and more aggressive. Not that it’ll matter too much with Microsoft being the only real option in non-tech enterprise.
- Proven 6y ago
  It's outrageous that one person can indirectly force millions to buy more expensive services. Anyone who cared and had the extra money could have always kept their data in the EU. Or not pay for any service that doesn't.
- icebraining 6y ago
  He created an NGO for this purpose, after having successfully sued Facebook: https://noyb.eu/en https://noyb.eu/en But the national data protection commissions of each country also do plenty of work. I think they're still swamped, though.
  - smartbit 6y ago
    nyob is in need of financial support https://noyb.eu/en/support-us https://noyb.eu/en/support-us. No need to leave you address unless you want to receive the goodies. No Credit Card required either, an EU bank account for SEPA transfers is sufficient. If you donate EUR 100, you get Consultation on private data protection cases (2h/year)
  - tgsovlerkhgsel 6y ago
    The Irish DPA seems to focus on not doing their work, and actively fighting back against having to do their work. The German DPAs love going after random individual cases they find, often in ways incompatible with reality (e.g. a small company not using GPG when e-mailing employees about HR issues), while ignoring major abuses that happen at scale. The biggest fine they issued was to a real estate management company for not deleting old documents (e.g. proof of income) that tenants had provided. Not a single fine against adtech companies.
lis 6y ago
In addition there is a short PR statement available for media use: https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202...
- hugoroy 6y ago
  This is the press release, edited by the services of the court - this is not written by the judges.
  - lis 6y ago
    Yes, thanks, I've clarified this.
pwdisswordfish2 6y ago
Start at page 61 if you just want the ruling. Perhaps this Wikipedia page will be updated soon: https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield

Krasnol 6y ago

This was long overdue. Let's hope they won't come up with a new name just as they did last time when Safe Harbour was abolished. This thing was an insult to EU privacy laws.

killerpopiller 6y ago
after "Safe-Harbor"and it's successor "EU-US Privacy-Shield" I suggest.. the "Trust-PACT" P - privacy A - acknowledged C - confidentiality T - treaty It's not only an insult of EU data protection laws and the EU basic rights charta. Not only are the big US cloud providers evading taxes and stiffling competition in the EU, they are also instrumental to US hegemonial ambitions. All your data (and taxes) belongs to us. That's whats going on. I wonder how long the standard contractual clauses will hold, I don't see how they are doing better.
- di4na 6y ago
  This judgement also validated SCC. Basically they are ok because they are underpinned by "the receiver country need to have proper privacy protections". So the SCC is legit. You just can't use it with the US.

geewee 6y ago

This is bad news for everyone in the EU who has data in the US and uses the Privacy Shield act as the protection guarantee. We do that currently for some data processors, and I'm a little intrigued about what we'll do with all of our US-based data now.

arpinum 6y ago
The ruling notes that standard contractual clauses are still available. Most providers offer a Data Processing Agreement that can be signed and amended to the standard contract for businesses in the EU. It then gets muddy though as a DPA needs to be considered against possible legal demands of the US Gov and whether the processor will be forced to comply, assuming the data is stored unencrypted and it is possible to comply.
- geewee 6y ago
  Yes hopefully it'll just be some extra paperwork.
- ThePhysicist 6y ago
  You cannot rely on these clauses if they can't be effectively enforced, so I'm doubtful whether they will allow you transferring personal data to the US.
- terom 6y ago
  Quoting from the press release, the data exporter must take into account both the contractual clauses AND the surveillance laws of the target country. It is not sufficient to rely on a contract with a US data processor where the US surveillance laws do not make it possible for the recipient to comply with that contract. > In those circumstances, the Court specifies that the assessment of that level of protection must take into consideration both the contractual clauses agreed between the data exporter established in the EU and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the data transferred, the relevant aspects of the legal system of that third country. > [...] that decision imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected in the third country concerned and that the decision requires the recipient to inform the data exporter of any inability to comply with the standard data protection clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former.

mlang23 6y ago

Finally! There is hope for EU, they apparently found some of their balls. Hope they keep 'em.

adamcharnock 6y ago

Hum. I’m in the process of starting up a Wireless ISP in Europe. I was looking at using a large piece of management software provided by a Canadian company, hosted in the US. This is starting to feel like a bit of a bad idea. I was already unimpressed with their “no one has ever asked us about GDPR” response. I can totally see an ISP getting heavier regulation in this regard too, given it is providing infrastructure. Maybe I’ll code it all up myself while I wait for the dedicated fibre to come through.

dx034 6y ago
Any reason why it has to be hosted in the US? Hosting is so standardized, it's hard to argue why it can't be moved to the EU.
- adamcharnock 6y ago
  It is a SaaS product and I guess that was just what made sense to them at the time. They say they have a lot of EU customers, but something doesn't add up. Either they don't have a lot of EU customers, or their EU customers are ignoring GDPR, hosting locations, and (in my case) regulations on invoicing software. Maybe those customers are just saying, "ah, it'll be fine, let's not worry about it." Which probably isn't a bad approach for small companies. I suppose my choice comes down to: Do I want something off the shelf, slick, a bit expensive, and may or may not screw me in known ways. Or do I want something custom, slow to build, a bit clunkly, can adapt to my needs at the cost of my time, and won't screw me in known ways. Of course, both may screw me in unknown ways :-) Anyway, thanks for listening. This is mostly me just thinking this though.
  - m4rtink 6y ago
    SaaS management system for WISP seems weird to me. From what I know from the local WISPs their internal systems need to be very robust and independent from internet connectivity, so when the network or Internet connectivity goes down, they are still available to quickly resolve the issue.

arpinum 6y ago

I work in a sector with a requirement to keep data out of the US. It is VERY hard to find providers who can promise not to do this. Even when servers exist in the EU, many provider's contracts have clauses that allow transfer to the US, as they have staff there who may access the data. I can see company legal departments taking this ruling to prohibit transfers, even with a DPA in place, and causing havoc around the EU.

mytailorisrich 6y ago
The EU depends too much on the US in this area. Hopefully this will force more independence and provide a boost to the European providers.
- sam_lowry_ 6y ago
  Which area? Hetzner, Leaseweb, OVH and dozens of smaller hosting providers can fill the needs. The only thing US hosting providers have is marketing and easy money.
  - corty 6y ago
    Hosted Microsoft products mostly, which is what tons of smaller companies want from "the cloud". And some AWS workalike, which usually means AWS, because the stackoverflow answer they found doesn't tell them about the rest.
    - nix23 6y ago
      Haha you are so right!! That i think is the biggest problem with Europe, Microsoft an Apple is just everywhere...probably even more Windows installations on servers than the US.
  - arpinum 6y ago
    Managed service offerings are the main difficulty. Bare servers aren't a problem.
6y ago

mtgx 6y ago

WSJ: Surprise ruling is a victory for privacy activists This wasn't a surprise at all. It was very predictable from the beginning for one simple reason: the US doesn't have strong privacy laws and the US government's surveillance apparatus doesn't account for whatever privacy laws exist either. All the gag orders (up to half of all total order requests according to Microsoft 2 years ago), all the tapping of internet cables and "partnerships" with the carriers, all the "fusion centers" with all agencies getting people's data, and so on. Oh, and best of all, the Privacy Shield said that it was up to the US DOJ to ensure US companies followed EU law. What a joke. The EU Charter of Fundamental rights prohibits data from being stored in countries that don't provide equivalent privacy protections as in the EU. If you follow this logic, it's obvious Privacy Shield was bound to fail. An article from 2018: https://www.hrw.org/news/2017/07/26/us-surveillance-makes-privacy-shield-invalid https://www.hrw.org/news/2017/07/26/us-surveillance-makes-pr...

tdrp 6y ago

Is there some kind of "we are in the EU and understand our data will be stored in the US and can be surveilled" consent box? What about platforms that connect people from all over the world? Yeah you can store EU users' data on an EU server but what if a US user checks out a EU user's profile. Or are we supposed to completely disconnect each continent?

Dobbs 6y ago
You work to the most restrictive set of rules. EU users data is stored in places that comply with the rules in question, that could be the US, if the US complies with EU rules. If US user wants to interact with EU content, then they need to comply with relevant EU rules. They might not have to give the same level of enthusiastic consent, but the data of their interaction should still stored in EU compliant manner.
- adventured 6y ago
  That's not quite correct. It depends entirely on what jurisdiction/s you fall under, where you do business. If you're a US entity you can freely store EU data on US servers entirely without EU permission or consent, and do anything with it that you want to (within US law), so long as you don't operate within the EU. For exactly the same reason that you can safely ignore GDPR if you don't operate in the EU. If I build a service that runs its servers only in the US, in nearly all cases I don't need to concern myself with EU laws. I'll be operating by US laws. I can allow EU users to sign up and use my service and store their data in the US. There's nothing the EU can do about that. The EU will have to enable a draconian Chinese firewall to stop this. They have no power or influence to dictate to the world such rules, so the only thing they can potentially do is put their own people in a safety box and lock them off from the rest of the world.
  - HatchedLake721 6y ago
    This is wrong? It doesn't matter where your servers are, if you offer a service to people in the EU and you store their personal data, you need to safeguard that data and comply with GDPR. It's a law, so it can be enforced through mutual international treaties. However, common sense prevails in the EU and especially with GDPR, so no one will go after you because you use Google Analytics and didn't give an option to opt-out. But if you start collecting personal addresses, emails and phones disguised as a charity doubling their contributions and then sell that information to callcenters abroad for tax scams and upload it to 4chan, then yes, EU's reach will be tested. https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/

secfirstmd 6y ago

Worth also remembering that at the moment the UK is still negotiating with the EU and hasn't got a data protection adequacy agreement in place. At the same time it is domestically pushing for increased surveillance laws and powers for GCHQ etc. That issue in many ways is going to be just, if not more, tricky.

_the_inflator 6y ago

At the political level this is going to fuel the conflict between USA and EU. Gas pipeline, data privacy - times have changed forever it seems between USA and EU.

bad_user 6y ago
I don't see a conflict. European countries have had consumer protection laws that are different from those in the US and US companies have had to comply. This situation is no different. The EU wants privacy & security guarantees that US companies can't deliver and special deals with the US government can't really fix that. But I'm sure US companies will adapt eventually. And this goes in both directions of course. For example European banks have to be really careful in dealing with US citizens due to laws like FATCA.
- allendoerfer 6y ago
  > For example European banks have to be really careful in dealing with US citizens due to laws like FATCA. Their fix is of course to require you to check the "I am not a US citizen" box.
  - the_svd_doctor 6y ago
    I don’t know if that’s sarcastic, but banks are scared to hell to deal with US citizens. They won’t ask you to fill the other box, they just won’t deal with you.
    - sebazzz 6y ago
      It is not sarcastic - my bank (ING) has these in the forms, for instance when getting started with their stock buying program.
      - lokedhs 6y ago
        Many banks will not allow US citizens to open accounts for that reason. If they have any US account holders, they will have to report to their tax authority.

vicmiclovich 6y ago

What if the US reciprocates? EU companies doing the same - keeping US data in the US.

jeroenhd 6y ago

Privacy Shield is dead, long live privacy shield. I wonder how many attempts it will take for this deal to be considered legal before the US actually has to do something to hold up their end of the deal. The US government would scream in rage if Germany would ever demand the ability to order Microsoft or Google to hand over information about US citizens in complete secret, yet the EU wil gladly take the word of the US government that it won't happen. The EU also has plenty of incentive to encourage keeping data within the boundaries of its member states. Making it difficult to use American tech giants as a lazy quick fix for data storage instead of looking at local alternatives only helps limit the amount of money taken from the European economy. With the scandals and state of the current US government I find it hard to believe the EU will be able to draft a new agreement like this with the US without compromising on the rights of their citizens.

KingOfCoders 6y ago
The US never will.
Dobbs 6y ago
> Privacy Shield is dead, long live privacy shield. Apologies for being pedantic, but "The king is dead, long live the king" is referring to two distinct uses of the word king. It is equivalent of "The old monarch is dead, long live the new monarch". So for this to work in your case it would need to be: "Privacy Shield is dead, long live new-replacement-law" But without a replacement law, the phrase just doesn't work.
- ceejayoz 6y ago
  That's probably why the first Privacy Shield was capitalized, but the second was not.
- jeroenhd 6y ago
  My point was that there will probably soon be a new, similarly lacking Privacy Shield with a similarly silly name (Secure Data Exchange Act? Privacy Protection Plus? Data Protector Agreement?). We don't know the name of the new law yet, but Privacy Shield was quickly implemented because the agreement before it was deemed insufficient, and the same will likely happen again.

fmajid 6y ago

I don’t know why the article claims the decision was “surprising”. I work for a US company that is subject to GDPR and we’ve been expecting this for over 2 years, the only unknown was when the ruling would happen, not if.

the_duke 6y ago

Already on the front page, with more comments: https://news.ycombinator.com/item?id=23856988 https://news.ycombinator.com/item?id=23856988 Both submissions are very shallow articles though.

idkwhoiam 6y ago

Imagine every country comes up with a similar law restricting personal data transfers. This will render Internet useless.

danarmak 6y ago
An Internet with no personal data is a far cry from useless.
- perpetualpatzer 6y ago
  But surely, you'd concede it's far less useful. No international email, social media. No access to foreign websites: IP addresses are personal data [0]. Possibly, service delivery is feasible if you set up a warehouse in both locations to freight forward, but any vendor without the means to operate in each country. While I expect my EU pals will say "but of course we will never apply the law that way," if this was the intent of the legislation, the legislation looks an awful lot like a nationalist tariff. [0]https://www.alstonprivacy.com/ecj-declares-ip-addresses-personal-data/?cn-reloaded=1 https://www.alstonprivacy.com/ecj-declares-ip-addresses-pers...
  - danarmak 6y ago
    > No access to foreign websites: IP addresses are personal data The OP talks about not storing personal data, which would mean e.g. not keeping logs of client IP addresses; that does not forbid the Internet. I agree that a law that literally says or is interpreted to say that my IP address must not cross international borders, forbids the international Internet. But there is no such law. It's possible to put together an argument to interpret laws in an undesirable or unexpected way. That's what lawyers are for. We have to have some measure of confidence in court rulings, that's part of the system, law interpretation is always being challenged. > No international email, social media. To the best of my understanding, the GDPR allows people to opt-in to send personal data. If I send an email to someone in the US, I deliberately share e.g. my name with them; that's legal. If I send an email to someone in Europe, and my and their email providers are companies operating in Europe, they should not transmit or store the email through US servers. That's not impossible. At least that's my understanding. The problem with social networks is legitimate, and a real problem, but it's vastly smaller than "the Internet".

Barrin92 6y ago

As a EU citizen I'm glad about the decision, I don't have any confidence any more that data stored in the US is secure and that the US can be depended upon. Also important to point out how much of this goes back to Max Schrems activism over the years and noyb (https://noyb.eu/en https://noyb.eu/en). This is a huge win achieved with relatively few resources. Staying engaged is worth it.

Frost1x 6y ago
As a US citizen, I'm personally glad to see other nations push back against data privacy exploitation by US businesses on the general public. It's evident our own (US) government will do very little to curb those business's overreach. I hope to see more disincentives put forth against these practices in markets our businesses haven't completely supplanted government oversight. Hopefully, that will result in shifts of practices in the US markets as well, though it's certainly not guaranteed.
- nojvek 6y ago
  China is looked down for its draconian surveillance. However US is just another side of the same coin. Our big Tech FAANG loves gobbling up everything they can get their hands upon in the name of training AIs that shove more personalized creepy ads.
  - jjcon 6y ago
    > China is looked down for its draconian surveillance. However US is just another side of the same coin. This is not the case - almost all major countries have surveillance agencies. It’s not the fact that China has surveilance that is looked down upon, it’s the lack of checks and balances. Most democratic countries have surveillance to ensure national security interests and they have strict checks and balances to minimize abuse and ensure that intel is used only for national security reasons. China’s surveillance has no such checks and balances and does little to prevent abuse and that is worth criticizing. Perhaps this may change someday but the current party does not seem to be heading in that direction.
6y ago

eitland 6y ago

Hmmmmm. If Apple can get away with providing a less secure version for China they could probably get away with creating a more secure version for Europe..?

poorman 6y ago

They are really making it impossible to start a small SaaS product. People already don’t want to pay $4/mo. for even some of the most popular SaaS products. I’m afraid all this is going to do is cause these small SaaS businesses to run twice as much infrastructure, and then transfer the costs onto the consumers by substantially increasing their prices.

FranzFerdiNaN 6y ago
Yes, privacy has a cost.
Cthulhu_ 6y ago
As it should be; I want to pay with money, not my data. And I want my spending to stay in my local economy, not to the bottomless pit that is the US.
Sebb767 6y ago
We're happily running a small SaaS with 4 servers using a small provider near Frankfurt for less than 50 Euro/Month. In fact, this provider is massively cheaper than AWS for bare metal and we had no service problems so far. It's maybe not five nines, but the limit is really not the service provider ATM.

jurschreuder 6y ago

I'm missing the point of why the USA would not just stop this weird spying on everybody. From China I'd expect nothing more but the USA? They're supposed to be a decent country. Then we would not need all these super unpractical counter measures.

Cthulhu_ 6y ago
> They're supposed to be a decent country. But they are not; they're dropping fast on the world scheme when it comes to human rights and common decency. In many ways it's as bad as China is when it comes to that. It's interesting that they managed to keep the ICE concentration camps out of the media. Will the >100K of covid-19 related deaths (that have been officially reported) someday be considered genocide / eugenics?
- e773yeydyyd 6y ago
  This is certainly a romantic take on the matter but for once the liberal arts students are actually ahead of the curve since for many of them this reading is a part of their standard curriculum (followed by an exercise where some defend the practice and some condemn it): https://www.wsj.com/articles/SB95326824311657269 https://www.wsj.com/articles/SB95326824311657269
  - kergonath 6y ago
    Spying is fair game. So is using obvious spying as a PR or political weapon. Dragnet surveillance is something else, though.
veeti 6y ago
Did people already forget all about the 2013 leaks? Do you actually think that the EU is not complicit in the same surveillance practiced by the US? > For example, Der Spiegel revealed how the German Foreign Intelligence Service transfers "massive amounts of intercepted data to the NSA", while Swedish Television revealed the National Defence Radio Establishment (FRA) provided the NSA with data from its cable collection, under a secret treaty signed in 1954 for bilateral cooperation on surveillance... How is my data any more secure on a German server than an American server? Some asshole is snooping on it anyway, and the NSA gets access by extension.

34679 6y ago

Nobody in the US government is going to scream in rage over the violation of your privacy. The last person who came close is hiding in Russia.

deleted 6y ago
[deleted]
StavrosK 6y ago
> Nobody in the US government is going to scream in rage over the violation of your privacy. by the US government. Plenty of people are screaming in rage about China, for example.
- simion314 6y ago
  That is not even close related with privacy or human rights and more about geo-politics.
  - tobessebot 6y ago
    US-EU data agreements are also about geopolitics.
    - simion314 6y ago
      Maybe, but there was some agreement and one party is not respecting it, so let's say is not nice not to respect your contracts. Star Trek fans are probably reminded by this rule of acquisitions; "A contract is a contract is a contract… but only between Ferengi."
      - normalnorm 6y ago
        The EU is not some weird hive-mind, it has separation of powers just like the US. It is the European Court of Justice's job to overturn executive decisions that trample on the constitutional rights of its citizens, same as the Supreme Court in the US.

terom 6y ago

The idea would be to align the commercial interests of US cloud service providers with the privacy interests of EU customers. From the EU citizens perspective, the ideal outcome would be for US cloud service providers to pressure US authorities to limit their surveillance of EU citizens and provide some kind of privacy guarantees. Here's to wishful thinking...

DaiPlusPlus 6y ago
Google, of all companies, was a major supporter of California's CCPA (Cali's GDPR-like legislation) last year. Cynically I suppose it was to ensure they'd at least have a say in what the CCPA covered... and to hurt their rivals (Facebook, etc).
- TomMarius 6y ago
  GDPR was supported by the biggest EU corporations as well - not much could help them more :-)
  - dijit 6y ago
    The idea the GDPR as a regulation helps established companies 'who can afford a gdpr team' more than joe the shoemaker is a weird meme.. GDPR hurts large companies that abuse data; the actual legislature is one of the most proportional regulations I've ever seen. You have the right to store peoples personal data if it's used and not processed for non-implied purposes (IE; generating profiles of people after sale) and not sold to another company. So when someone throws up a big "GDPR NOTICE" and you have to press the big "i agree" button, it behooves to read it; because that's often not required for the service, it's what's required for the company to sell on your data. Joe the Shoemaker can take your email address or phone number and call you, he's not going to have a hard time under GDPR. If you're abusing data, you're going to have a hard time- and that's good.
    - TomMarius 6y ago
      Most companies don't (and never did nor are or were in position to) abuse data, but all companies now must adhere to GDPR. ;-) The world really isn't either Facebook or Joe the Shoemaker. There's a lot in between.

KingOfCoders 6y ago

This means noone in the EU can sell on Amazon or eBay. Noone can use services like WebFlow and other hosting solutions. We'll see what future court decisions say about AWS hosted inside the EU.

KingOfCoders 6y ago
Everyone who sells on Amazon and eBay has a data protection policy which mentions Privacy Shield to legally work with Amazon. The court says only DPAs work where you make sure that the other party protects data on a GDPR level, which Amazon doesn't do and can't do.

KingOfCoders 6y ago

Noone in the EU now can sell on Amazon or eBay.

rydre 6y ago

Good job Euros! Now you need to level up tech sector, get rid of the shackles of Google, Apple, Facebook. Your startups deserve better then the current, anti competitive and worse environment! Your companies could do much better, now is the time and make it happen.

leadingthenet 6y ago
It’s never going to happen. We’re a completely decadent society, and we’re essentially out of the IT race at this point.
- zurfer 6y ago
  Well it's not even the right point to discuss. A lot of great software is developed in Europe (not necessarily by companies with European headquarters). But why should software companies be tied to a specific region. Great software can come from the US, Australia, Asia, Europe, ... Because in the end it comes from people and the entrance barrier gets lower and lower. What you point to is probably more a question of finance and ownership.
- pjc50 6y ago
  People keep saying this while ignoring the local huge boring IT companies and local subsidiaries of US IT companies. Does it really matter where the nameplate that indicates where the HQ is? Or does it matter where the profits are taken for tax purposes (Apple appears to be an Irish company, by that measure)? Or where the CEO and board members are domiciled? Where the actual staff sit when they work?
  - d1zzy 6y ago
    So what you're saying is, that as long as there are other places in the world, outside of Europe, that still have a regulatory/financial/mentality/etc framework where new large software corporations can appear and flourish (and then open offices in Europe), then it's all good for Europe. If so, doesn't that seem a bit hypocritical? To have tighter privacy regulations locally but then be happy to accept business/jobs from companies that exist _because_ of no such regulations in other places (or at the time they were established)?

lukejduncan 6y ago

Dumb question: can someone explain to me the implications on startups and side projects? Does data mean, any data? If I’m reading that correctly it’s illegal to allow EU users to use any website with a DB that isn’t hosted in the EU. That can’t be correct, can it?

x0x0 6y ago
EU residents enjoy a right to data protection. US residents do not. EU allows export of their residents' personal data to the US under different sets of rules or methods, one of which is (was?) Privacy Shield. Another is Contractual Clauses. The crucial fact for Privacy Shield is it was supposed to provide "equivalent" protections (ie protection for EU data hosted in the US equivalent to that data being entirely in the EU). It did not. My take is that Privacy Shield was a sop to the fact that the US never had anything like equivalent privacy laws, but we are (were?) too big a trading partner to apply the law to. This realpolitik appears now to be in question. So yes, one of the ways to legally allow a US-based company to process EU resident data has now been removed.
M2Ys4U 6y ago
It's personal data. Which is defined in the GDPR as: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
- lukejduncan 6y ago
  I’m sure the true answer is ambiguous, but “personal data” by that definition seems to imply almost any form of account creation. For sure, that seems to imply you can’t use email addresses as identifiers. Maybe it implies that so long as the data isn’t de facto joinable with side data (phone numbers, email addresses) it may be ok.
IAmEveryone 6y ago

jjcon 6y ago

> to adequately protect Europeans' data from US surveillance and security laws and was therefore invalid Certainly this is more about protection from corporations with the added benefit of preserving what’s left of tech in the EU. Considering the US and most major EU countries share intelligence information with each other and all have surveillance programs I don’t know that it would be very effective at doing that no matter where the data is.

brownbat 6y ago

Will this have implications for Chinese and Russian services as well? Will the EU go fully local?

M2Ys4U 6y ago
Not really, because the European Commission has not issued an adequacy decision in relation to China and Russia as far as I'm aware. Russia is an interesting case, though. They are bound by the European Convention on Human Rights (although enforcement is... let's say tricky), and they are also signatories to Convention 108 (the Council of Europe "Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data") and they have signed (but not ratified) the protocol to update the convention (223, combined known as Convention 108+). This - in theory - puts them at an advantage over countries like the US which lack any real privacy legislation. However 1) Theory and practice aren't the same; and 2) I think it would be an impossibly hard sell for the Commission to issue an adequacy decision for Russia purely for political reasons, let alone practical ones.
- brownbat 6y ago
  Oh interesting: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte... So Russia/China are already in the "further safeguards needed" camp, along with... almost all of the world? I studied a bit of EU law in law school, but haven't kept up as much as I should. This is a helpful start to dig back in, thanks!

boshomi 6y ago

Max Schrems[1]: “The Court clarified for a second time now that there is a clash between EU privacy law and US surveillance law. As the EU will not change its fundamental rights to please the NSA, the only way to overcome this clash is for the US to introduce solid privacy rights for all people – including foreigners. Surveillance reform thereby becomes crucial for the business interests of Silicon Valley." "This judgment is not the cause of a limit to data transfers, but the consequence of US surveillance laws. You can’t blame the Court for saying the unavoidable - when shit hits the fan, you can’t blame the fan." [1] https://noyb.eu/en/cjeu https://noyb.eu/en/cjeu

Aachen 6y ago

This has been going back and forth for a long time now. Perhaps I'm being naive, but given light delay, companies already host data about and data accessed by citizens from <insert continent> on said continent, so why don't companies just store EU data in the EU and be done with it? Wouldn't that solve the whole issue, years in court, ambiguous rules, companies/agencies that require local storage, etc.?

plandis 6y ago

This just seems protectionist to me. I imagine anything the US is doing is being done by spy/sigint agencies within the EU